Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

New York

Washington, D.C.

core/separator

core/heading

core/list

While the California Consumer Privacy Act (CCPA) has been in effect since January 1 and the enforcement of the Act began on July 1, the implementing regulations were not in place on either date. After a lengthy administrative process, those regulations are finally in place. The final step was taken when the state’s Office of Administrative Law (OAL) approved those regulations, effective as of August 14, 2020. The approval of these final regulations establishes specific content and administrative compliance obligations for businesses subject to the CCPA. All businesses subject to the CCPA must now comply with both the statute and the final regulations.

contentpilot/introduction

While the final implementing regulations are similar to the draft proposed to the OAL on June 1, 2020, the OAL made additional revisions to the proposed regulations during its review process, and also published an “<a href="https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/addendum-fsor.pdf" target="_blank" rel="noopener">Addendum</a>” to its Final Statement of Reasons, which sets forth its rationale and justifications for these revisions. Although the revisions were mostly non-substantive changes for accuracy, consistency, and clarity (e.g., ensuring “consumer” is used throughout the regulations), OAL did amend or withdraw several provisions, including the following: (i) consumer consent for materially different data processing, (ii) changing the “do not sell” notice language, (iii) offline opt-out minimum requirements and notices, (iv) methods for accepting opt-out requests, and (v)&nbsp;verification of an authorized agent.

core/paragraph

Removal of Consumer Consent Requirement for Materially Different Data Processing

With the removal of Section 999.305(a)(5) from the CCPA regulations, businesses are no longer required to obtain consumers’ explicit consent before using their personal information for a “materially different” purpose than previously disclosed. Although this may provide some flexibility, businesses need to be mindful of other CCPA provisions and general consumer protection laws, which broadly prohibit deceptive acts and practices, such as the Federal Trade Commission Act. In other words, using personal information for purposes other than what was disclosed to consumers at the time of collection still carries with it very substantial liability risks, even under the CCPA itself.

The Shorter “Do Not Sell My Info” Notice/Link Option Deleted

Section 999.306(b)(1) previously allowed businesses to provide the notice of the right to “opt-out” by providing a link stating either “Do Not Sell My Personal Information” or “Do Not Sell My Info.” The final regulations removed the “Do Not Sell My Info” option to mirror the language of the CCPA statute.

The Offline “Do Not Sell” Opt-Out Notice Requirement Removed

The removal of Section 999.306(b)(2) alleviates the obligations, which only applied to businesses that substantially interact with consumers in an offline environment, that they provide consumers with notice of their right to opt-out through an “offline method,” such as a printed notice. Accordingly, the CCPA regulations only require such notice to be posted on a business’s website or (in the event the business does not operate a website) through “another method” that properly informs consumers of their right to opt-out, such as by directing consumers to their online opt-out form. Businesses are still required, however, to provide a “notice at collection,” including when businesses collect personal information offline (e.g., printed forms, telephonic collection).

Request to Opt-Out of the Sale of Personal Information

Section 999.315(c) has been withdrawn from the CCPA regulations in full. As previously written, it would have mandated that the opt-out process be “easy,” with minimal steps required to facilitate such a demand, and it prohibited a business from using methods that subverted or impaired a consumer’s ability to make a decision to opt-out. The vagueness of that requirement caused considerable compliance uncertainty. Businesses still are required, however, to offer “a global option to opt-out of the sale of all personal information” under section 999.315(a) and to provide two methods for submitting such a request.

Accepting Requests from Authorized Agents

Section 999.326(c) has been removed from the CCPA regulations. This provision would have allowed businesses to deny requests submitted by authorized agents on behalf of consumers if the authorized agents did not submit “proof” of authorization by the consumer. This change, however, does not appear to substantively alter businesses’ ability to refuse requests from authorized agents as that process is also detailed in the sections of the regulations that cover each type of request. For instance, section 999.315(f) permits businesses to deny a request to opt-out that is submitted from an authorized agent if the agent does not provide the consumer’s “signed permission” to act on his or her behalf.

While July 1, 2020 marked the CCPA’s enforcement date, the final regulations solidify businesses’ compliance requirements. Accordingly, businesses who have not yet implemented the unique disclosure and business process requirements set forth under the CCPA’s final regulations should take immediate steps to bring their programs into compliance. The International Association of Privacy Professionals published a series of articles by Thompson Hine that addresses the more complicated aspects of the CCPA, and these articles can be accessed <a href="https://iapp.org/about/person/0011a00000DlHQYAA3/" target="_blank" rel="noopener">here</a>. In fact, some of the recent changes to the CCPA regulations directly align with the thoughts and concerns raised by Thompson Hine in these articles.

As we have previously noted, the California Privacy Rights Act (CPRA) initiative remains on track to appear on the November 2020 ballot and may add more California privacy requirements and impact the CCPA.

If you have any questions on how the finalized regulations may affect your business, please contact one of the Thompson Hine attorneys listed below.

Thomas F. Zych 216.566.5605 <a href="mailto:Tom.Zych@ThompsonHine.com">Tom.Zych@ThompsonHine.com</a>

Steven G. Stransky 216.566.5646 202.263.4126 <a href="mailto:Steve.Stransky@ThompsonHine.com">Steve.Stransky@ThompsonHine.com</a>

Darcy M. Brosky 216.566.5774 <a href="mailto:Darcy.Brosky@ThompsonHine.com">Darcy.Brosky@ThompsonHine.com</a>

Craig A. Foster 614.469.3280 <a href="mailto:Craig.Foster@ThompsonHine.com">Craig.Foster@ThompsonHine.com</a>

Mona Adabi 202.263.4147 <a href="mailto:Mona.Adabi@ThompsonHine.com">Mona.Adabi@ThompsonHine.com</a>

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2022/04/Privacy__Cybersecurity_Update_-_Final_CCPA_Regulations_Approved_Effective_Immediately.pdf

Final CCPA Regulations Approved Effective Immediately

Services